Enforcement Action by ICO against Unite the Union

The ICO issued a penalty against Unite the Union for unsolicited direct marketing calls despite having explicitly opted out and by those who had not given informed valid consent to receive such calls.

In this case, the Information Commissioner was investigating whether Unite the Union had violated Regulation 21 of the Privacy and Electronic (EC Directive) Regulations 2003 (PECR) by contacting individuals to promote life insurance without their consent. The Commissioner received 27 complaints from individuals who claimed to have received unsolicited calls despite not giving consent, and two complainants explicitly opted out of such marketing but still received further calls. The Commissioner discovered that 57,665 calls were made to individuals registered with the Telephone Preference Service Ltd (TPS) for 28 days or longer, which is prohibited under Regulation 21 unless consent is given. The Commissioner found that Unite did not provide sufficient information to individuals about the use of their personal information, and that the individuals were only "broadly informed," which is not enough to establish valid consent. The Commissioner determined that this violation of Regulation 21 was serious and warranted a monetary penalty. However, the Commissioner found that Unite did not deliberately set out to contravene the PECR, but was negligent in not making use of the resources provided by the Information Commissioner's Office. The Commissioner found that Unite failed to take reasonable steps to prevent the risk of contravention materializing and considered the complaints of 27 individuals to be sufficient to warrant a monetary penalty.